@skyhook-io/k8s-ui 1.10.3 → 1.10.5

package/src/components/trace/TraceSummary.test.ts

@@ -0,0 +1,213 @@
+import { describe, it, expect } from 'vitest'
+import { summarizeTrace } from './TraceSummary'
+import type { Trace, Coverage, RouteResult } from './types'
+
+const trace = (o: Partial<Trace>): Trace => ({
+  subject: { kind: 'Service', namespace: 'prod', name: 'api' },
+  upstreams: [], downstream: [], verdict: 'healthy', brokenAt: -1, ...o,
+})
+const cov = (o: Partial<Coverage>): Coverage => ({ tested: 0, passed: 0, failed: 0, skipped: 0, ...o })
+const route = (o: Partial<RouteResult>): RouteResult => ({ route: '/', outcome: 'verified', ...o })
+
+describe('summarizeTrace - the passive drawer glance', () => {
+  it('minimal when not probed (static / config-only): invites the run positively, no tone, no worst line', () => {
+    const v = summarizeTrace(trace({}))
+    expect(v.kind).toBe('minimal')
+    expect(v.ctaLabel).toBe('Run test →')
+    // Positive, action-first framing - never the negative "not tested".
+    expect(v.headline.toLowerCase()).not.toContain('not tested')
+    expect(v.headline.toLowerCase()).toContain('path')
+    expect(v.subtitle).toBeTruthy()
+    expect(v.tone).toBeUndefined()
+    expect(v.worst).toBeUndefined()
+  })
+
+  it('a coverage projection with tested===0 is NOT a probed glance - falls through to config-only (never "not yet tested" headline + "See test detail")', () => {
+    const v = summarizeTrace(trace({
+      verdict: 'healthy',
+      headline: 'Configuration only - not yet tested',
+      coverage: cov({ tested: 0, skipped: 1 }),
+      notTested: [{}] as Trace['notTested'],
+    }))
+    expect(v.headline).not.toContain('Configuration only')
+    expect(v.ctaLabel).toBe('Run test →')
+  })
+
+  // The drawer performs NO detection of its own - every config-only (unprobed) trace
+  // yields the minimal invite button. Config findings, verdicts, and the diagnosis are
+  // owned by the resource's Operational Issues section; the drawer never echoes them.
+  it('a config red flag (e.g. a NetworkPolicy would-deny) is NOT surfaced in the drawer - it stays the invite button', () => {
+    const v = summarizeTrace(trace({
+      verdict: 'degraded',
+      downstream: [
+        { resource: { kind: 'Pods', namespace: 'prod', name: '' }, edge: 'Service->Pods', findings: [
+          { code: 'netpol:would-deny', severity: 'warning', message: 'A cluster network rule would block traffic to these pods on :80' },
+        ] },
+      ],
+    }))
+    expect(v.kind).toBe('minimal')
+    expect(v.ctaLabel).toBe('Run test →')
+    expect(v.headline).not.toContain('network rule')
+    expect(v.tone).toBeUndefined()
+  })
+
+  it('partial failure: warning tone + the worst-offender line + Open Reachability CTA', () => {
+    const v = summarizeTrace(trace({
+      headline: '1 of 2 routes reachable · 1 unreachable',
+      coverage: cov({ tested: 2, passed: 1, failed: 1 }),
+      routes: [
+        route({ route: '/web', outcome: 'verified', confidence: 'real' }),
+        route({ route: '/admin', target: 'admin:9090', outcome: 'unreachable', confidence: 'real', evidence: 'connection refused' }),
+      ],
+    }))
+    expect(v.kind).toBe('glance')
+    expect(v.tone).toBe('warning')
+    expect(v.worst).toEqual({ route: '/admin', target: 'admin:9090', evidence: 'connection refused', failingCount: 1 })
+    expect(v.ctaLabel).toBe('Open Reachability →')
+  })
+
+  it('all unreachable (none passed): error tone + worst line', () => {
+    const v = summarizeTrace(trace({
+      headline: 'None of 1 routes reachable',
+      coverage: cov({ tested: 1, passed: 0, failed: 1 }),
+      routes: [route({ route: '/', target: 'api:80', outcome: 'unreachable', confidence: 'real', evidence: 'connection refused' })],
+    }))
+    expect(v.tone).toBe('error')
+    expect(v.worst?.route).toBe('/')
+    // A single failing route is just "the failing route" - not "worst of N".
+    expect(v.worst?.failingCount).toBe(1)
+  })
+
+  it('multiple failing routes: failingCount reflects all of them (label becomes "Worst of N")', () => {
+    const v = summarizeTrace(trace({
+      headline: '1 of 3 routes reachable · 2 unreachable',
+      coverage: cov({ tested: 3, passed: 1, failed: 2 }),
+      routes: [
+        route({ route: '/web', outcome: 'verified', confidence: 'real' }),
+        route({ route: '/admin', target: 'admin:9090', outcome: 'unreachable', confidence: 'real', evidence: 'connection refused' }),
+        route({ route: '/api', target: 'api:80', outcome: 'server-error', confidence: 'real', evidence: 'HTTP 503' }),
+      ],
+    }))
+    expect(v.worst?.failingCount).toBe(2)
+    // Worst-first: unreachable outranks server-error.
+    expect(v.worst?.route).toBe('/admin')
+  })
+
+  it('healthy verified: calm - success tone, NO worst line, "See test detail" CTA', () => {
+    const v = summarizeTrace(trace({
+      headline: 'All 1 routes reachable',
+      coverage: cov({ tested: 1, passed: 1 }),
+      routes: [route({ outcome: 'verified', confidence: 'real' })],
+    }))
+    expect(v.kind).toBe('glance')
+    expect(v.tone).toBe('success')
+    expect(v.worst).toBeUndefined()
+    expect(v.ctaLabel).toBe('See test detail →')
+  })
+
+  it('benign scale-to-0 reads amber and is NEVER surfaced as the worst offender', () => {
+    const v = summarizeTrace(trace({
+      headline: 'No running backends (scaled to 0)',
+      coverage: cov({ tested: 1, passed: 0, failed: 1 }),
+      routes: [route({ route: '/', outcome: 'unreachable', benign: true })],
+    }))
+    expect(v.tone).toBe('warning') // benign → amber, not red
+    expect(v.worst).toBeUndefined() // not called out as a failure
+  })
+
+  it('surfaces the not-tested count from notTested length', () => {
+    const v = summarizeTrace(trace({
+      headline: 'All 1 tested routes reachable · 2 not tested',
+      coverage: cov({ tested: 1, passed: 1, skipped: 2 }),
+      routes: [route({ outcome: 'verified', confidence: 'real' })],
+      notTested: [{}, {}] as Trace['notTested'],
+    }))
+    expect(v.notTested).toBe(2)
+  })
+
+  it('a broken / degraded / unknown verdict is NOT surfaced in the drawer - no config headline, just the invite button', () => {
+    for (const verdict of ['broken', 'degraded', 'unknown'] as const) {
+      const v = summarizeTrace(trace({
+        verdict,
+        headline: 'Configuration only - not yet tested',
+        reason: 'RBAC denied: cannot list pods in namespace prod',
+        diagnosis: { summary: '0/2 selected pods ready' } as Trace['diagnosis'],
+      }))
+      expect(v.kind).toBe('minimal')
+      expect(v.ctaLabel).toBe('Run test →')
+      expect(v.headline).not.toContain('0/2 selected pods ready')
+      expect(v.headline).not.toContain('RBAC denied')
+      expect(v.headline).not.toContain('Configuration only')
+      expect(v.tone).toBeUndefined()
+    }
+  })
+
+  it('clean static (healthy, not probed) is a minimal entry point - the Ports section already shows the wiring, so the glance must NOT restate "routes to N pods on :80"', () => {
+    const v = summarizeTrace(trace({
+      verdict: 'healthy',
+      headline: 'Configuration only - not yet tested',
+      downstream: [
+        { resource: { kind: 'Service', namespace: 'prod', name: 'echo' }, edge: 'entry:Service', findings: [], config: { ports: [{ port: 80, targetPort: '8080' }], hostnames: ['shop.example.com'] } },
+        { resource: { kind: 'Pods', namespace: 'prod', name: '' }, edge: 'Service->Pods', findings: [], meta: { ready: 1, selected: 1 } },
+      ],
+    }))
+    expect(v.kind).toBe('minimal')
+    expect(v.headline.toLowerCase()).not.toContain('not tested')
+    expect(v.headline).not.toContain('running pod')
+    expect(v.headline).not.toContain('shop.example.com')
+    expect(v.headline).not.toContain('port 80')
+    expect(v.subtitle).toBe('A quick live connection test from where Radar runs.')
+    expect(v.ctaLabel).toBe('Run test →')
+  })
+
+  it('path-owning subject (Ingress) clean+unprobed: NO wiring restatement - "routes to N pods" both repeats the Rules section and overclaims the unverified front door', () => {
+    const v = summarizeTrace(trace({
+      subject: { kind: 'Ingress', namespace: 'prod', name: 'wild' },
+      verdict: 'healthy',
+      headline: 'Configuration only - not yet tested',
+      downstream: [
+        { resource: { kind: 'Service', namespace: 'prod', name: 'echo' }, edge: 'entry:Service', findings: [], config: { ports: [{ port: 80 }], hostnames: ['shop.example.com'] } },
+        { resource: { kind: 'Pods', namespace: 'prod', name: '' }, edge: 'Service->Pods', findings: [], meta: { ready: 1, selected: 1 } },
+      ],
+    }))
+    expect(v.kind).toBe('minimal')
+    expect(v.headline.toLowerCase()).not.toContain('not tested')
+    expect(v.headline.toLowerCase()).toContain('front door')
+    // Never asserts the backend wiring as if it were the verified entry.
+    expect(v.headline).not.toContain('routes to')
+    expect(v.headline).not.toContain('running pod')
+    expect(v.headline).not.toContain('shop.example.com')
+    expect(v.subtitle).toBe('A quick live probe of the declared host and path.')
+    expect(v.tone).toBeUndefined()
+    expect(v.ctaLabel).toBe('Run test →')
+  })
+
+  it('Service subject clean+unprobed does NOT restate the wiring - the Ports section already covers port→running-pod, so the glance stays a minimal Run entry point', () => {
+    const v = summarizeTrace(trace({
+      subject: { kind: 'Service', namespace: 'prod', name: 'echo' },
+      verdict: 'healthy',
+      downstream: [
+        { resource: { kind: 'Service', namespace: 'prod', name: 'echo' }, edge: 'entry:Service', findings: [], config: { ports: [{ port: 80 }], hostnames: ['shop.example.com'] } },
+        { resource: { kind: 'Pods', namespace: 'prod', name: '' }, edge: 'Service->Pods', findings: [], meta: { ready: 1, selected: 1 } },
+      ],
+    }))
+    expect(v.kind).toBe('minimal')
+    expect(v.headline.toLowerCase()).not.toContain('not tested')
+    expect(v.headline).not.toContain('running pod')
+    expect(v.headline).not.toContain('shop.example.com')
+  })
+
+  it('0 ready pods (crashing / scaled-to-zero / no selector match) is NOT surfaced - the invite button, not a "no running pods" line', () => {
+    const v = summarizeTrace(trace({
+      verdict: 'healthy',
+      downstream: [
+        { resource: { kind: 'Service', namespace: 'prod', name: 'echo' }, edge: 'entry:Service', findings: [{ code: 'svc:no-ready-endpoints', severity: 'warning', message: 'no ready endpoints' }], config: { ports: [{ port: 80 }] } },
+        { resource: { kind: 'Pods', namespace: 'prod', name: '' }, edge: 'Service->Pods', findings: [], meta: { ready: 0, selected: 2 } },
+      ],
+    }))
+    expect(v.kind).toBe('minimal')
+    expect(v.headline).not.toContain('running pod')
+    expect(v.headline).not.toContain('endpoints')
+    expect(v.ctaLabel).toBe('Run test →')
+  })
+})

package/src/components/trace/TraceSummary.tsx

@@ -0,0 +1,168 @@
+import type { ComponentType } from 'react'
+import { CheckCircle2, AlertTriangle, ShieldAlert, Info } from 'lucide-react'
+import { AlertBanner } from '../ui/drawer-components'
+import { coverageBannerTone, routeOutcomeRank } from './TracePanel'
+import type { Trace } from './types'
+
+type Tone = ReturnType<typeof coverageBannerTone>
+
+const ICON: Record<Tone, ComponentType<{ className?: string }>> = {
+  success: CheckCircle2,
+  warning: AlertTriangle,
+  error: ShieldAlert,
+  info: Info,
+}
+
+/** The passive drawer view-model - extracted as a pure function so the decision
+ *  logic (tone, worst-offender-when-failing, CTA label) is unit-testable without
+ *  a DOM. `minimal` = no coverage projection yet (static/config-only); `glance` =
+ *  a coverage headline with its single honest tone. */
+export interface TraceSummaryView {
+  kind: 'glance' | 'minimal'
+  headline: string
+  tone?: Tone
+  /** The failing route to spotlight under the headline, with a count of how many
+   *  routes failed in total - so the label can read honestly ("Failing route"
+   *  for one, "Worst of N failing routes" when there are more). */
+  worst?: { route: string; target?: string; evidence?: string; failingCount: number }
+  /** A muted descriptive line under the headline. */
+  subtitle?: string
+  notTested: number
+  ctaLabel: string
+}
+
+// The drawer never runs active probes (that emits real traffic - deliberate, see
+// client.ts useTrace), so before a run it only INVITES the test, never implies one
+// ran. The "Reachability · Network Path" section header already carries the word
+// "reachability", so the button drops it ("Run test →") to avoid the echo.
+const RUN_CTA_SHORT = 'Run test →'
+
+export function summarizeTrace(trace: Trace): TraceSummaryView {
+  const coverage = trace.coverage
+  const routes = trace.routes ?? []
+
+  // PROBED - actual probe results exist (tested > 0) → the route-coverage glance.
+  // A coverage projection with tested === 0 is NOT a tested result (the drawer never
+  // probes), so it falls through to the invite-to-test button below.
+  if (coverage && coverage.tested > 0 && trace.headline) {
+    const tone = coverageBannerTone(coverage, routes)
+    const failing = coverage.failed > 0
+    // The worst-offender line shows ONLY when a route genuinely failed. Benign
+    // scale-to-0 is intentional dormancy, not a failure to call out.
+    const failingRoutes = failing
+      ? [...routes]
+          // An apiserver-proxy-only (indirect) unreachable never confirmed the real
+          // path - it's amber in coverageBannerTone, so it must NOT be spotlighted as
+          // a definitive "Failing route" here. A genuinely-down backend is upgraded to
+          // confidence 'real' upstream (definitive 0-ready endpoints), so it still shows.
+          .filter((r) => (r.outcome === 'server-error' || (r.outcome === 'unreachable' && r.confidence !== 'indirect')) && !r.benign)
+          .sort((a, b) => routeOutcomeRank(a.outcome) - routeOutcomeRank(b.outcome))
+      : []
+    const worstRoute = failingRoutes[0]
+    return {
+      kind: 'glance',
+      headline: trace.headline,
+      tone,
+      worst: worstRoute && {
+        route: worstRoute.route,
+        target: worstRoute.target,
+        evidence: worstRoute.evidence,
+        failingCount: failingRoutes.length,
+      },
+      notTested: trace.notTested?.length ?? coverage.skipped,
+      // Calm when healthy ("see detail"), actionable when failing ("open").
+      ctaLabel: failing ? 'Open Reachability →' : 'See test detail →',
+    }
+  }
+
+  // Nothing actively tested. The drawer does NOT detect config issues - those are
+  // owned by the resource's Operational Issues section (main's central detector). The
+  // reachability glance is purely the invitation to run the live path test; it never
+  // re-states anything the config already shows above it.
+  //
+  // For a PATH-OWNING subject (Ingress/Gateway/Route) it frames the front door;
+  // the host→backend wiring is already in the resource's own Rules section.
+  if (PATH_OWNING_KINDS.has(trace.subject.kind)) {
+    return {
+      kind: 'minimal',
+      headline: 'Verify the path in through the front door',
+      subtitle: 'A quick live probe of the declared host and path.',
+      notTested: 0,
+      ctaLabel: RUN_CTA_SHORT,
+    }
+  }
+  //    For a Service/Pod subject the Ports section already shows the port →
+  //    running-pod wiring, so restating it here ("routes to N pods on :80") just
+  //    duplicates it. Frame the empty state around the VALUE of the live test
+  //    (positive, action-first) - never a negative "not tested yet".
+  return {
+    kind: 'minimal',
+    headline: 'Verify the live path to these pods',
+    subtitle: 'A quick live connection test from where Radar runs.',
+    notTested: 0,
+    ctaLabel: RUN_CTA_SHORT,
+  }
+}
+
+// Subjects whose own renderer already prints their routing rules (host→backend),
+// so the reachability glance must NOT restate the wiring - and "routes to N
+// pods" would overclaim a front door it never verified.
+const PATH_OWNING_KINDS = new Set(['Ingress', 'Gateway', 'HTTPRoute', 'GRPCRoute'])
+
+/**
+ * TraceSummary is the PASSIVE drawer glance for the network-reachability path:
+ * one honest headline (tone from coverageBannerTone - the SAME single tone source
+ * the full panel uses), a worst-offender line ONLY when something failed, a muted
+ * not-tested count, and ONE CTA into the full Reachability tab. It never nags - a
+ * healthy verified path reads as a calm one-liner. The full route matrix, per-route
+ * localization, path topology, and the in-cluster test all live on the tab
+ * (TracePanel), reachable via the CTA. The drawer stays a glance, not a console.
+ */
+export function TraceSummary({ trace, onOpenReachability }: { trace: Trace; onOpenReachability: () => void }) {
+  const v = summarizeTrace(trace)
+
+  if (v.kind === 'minimal') {
+    return (
+      <div className="flex flex-col gap-1">
+        <div className="flex items-center justify-between gap-2 text-sm text-theme-text-secondary">
+          <span className="truncate">{v.headline}</span>
+          <OpenButton onClick={onOpenReachability} label={v.ctaLabel} />
+        </div>
+        {v.subtitle && <span className="text-xs text-theme-text-tertiary">{v.subtitle}</span>}
+      </div>
+    )
+  }
+
+  return (
+    <AlertBanner variant={v.tone!} icon={ICON[v.tone!]} title={v.headline}>
+      {v.worst && (
+        <div className="mt-1 text-xs">
+          <span className="text-theme-text-secondary">
+            {v.worst.failingCount > 1 ? `Worst of ${v.worst.failingCount} failing routes: ` : 'Failing route: '}
+          </span>
+          <span className="font-mono text-theme-text-primary break-all">{v.worst.route}</span>
+          {v.worst.target && <span className="text-theme-text-tertiary break-all"> → {v.worst.target}</span>}
+          {v.worst.evidence && <span className="text-theme-text-tertiary"> · {v.worst.evidence}</span>}
+        </div>
+      )}
+      {v.subtitle ? (
+        <div className="mt-1 text-xs text-theme-text-tertiary">{v.subtitle}</div>
+      ) : (
+        v.notTested > 0 && <div className="mt-1 text-xs text-theme-text-tertiary">{v.notTested} not tested</div>
+      )}
+      <OpenButton onClick={onOpenReachability} label={v.ctaLabel} />
+    </AlertBanner>
+  )
+}
+
+function OpenButton({ onClick, label }: { onClick: () => void; label: string }) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      className="mt-2 text-xs px-2 py-1 rounded border border-theme-border bg-theme-surface text-theme-text-primary hover:bg-theme-hover transition-colors"
+    >
+      {label}
+    </button>
+  )
+}

package/src/components/trace/inClusterSummary.test.ts

@@ -0,0 +1,98 @@
+import { describe, it, expect } from 'vitest'
+import { summarizeInClusterTests, evidenceBannerTitle, type InClusterTestRow } from './inClusterSummary'
+
+// The three server row shapes (internal/reachability/incluster.go):
+//   folded       - results, NO status        (default branch: outcome moved)
+//   evidence     - results AND status         (throwaway-denied / override-mismatch / guessed)
+//   couldn't-run - status/fallback, NO results (Job failed / capped / budget)
+const folded = (): InClusterTestRow => ({ results: [{ layer: 'http', ok: true }] })
+const throwawayDenied = (): InClusterTestRow => ({
+  results: [{ layer: 'http', ok: false }],
+  status: "in-cluster probe from a throwaway pod didn't get through - not a confirmed failure",
+  fallbackCommand: 'kubectl run ...',
+})
+const overrideMismatch = (): InClusterTestRow => ({
+  results: [{ layer: 'http', ok: true }],
+  status: 'tested custom path /x: shown as evidence only; the declared path / was not tested',
+})
+const guessedPath = (): InClusterTestRow => ({
+  results: [{ layer: 'http', ok: true }],
+  status: 'in-cluster probe reached the backend on a GUESSED path',
+})
+const jobFailed = (): InClusterTestRow => ({ status: 'in-cluster probe timed out: probe container couldn\'t start', fallbackCommand: 'kubectl ...' })
+const capped = (): InClusterTestRow => ({ status: 'not tested in-cluster: capped at 8 probe pods per call' })
+
+describe('summarizeInClusterTests', () => {
+  it('nothing ran (all status-only, no results) → couldn\'t run, not partial, not evidence-only', () => {
+    const s = summarizeInClusterTests([jobFailed()])
+    expect(s.error).toContain('timed out')
+    expect(s.fallback).toBe('kubectl ...')
+    expect(s.partial).toBe(false)
+    expect(s.evidenceOnly).toBe(false)
+  })
+
+  it('some folded + a couldn\'t-run row → error set AND partial true (partially completed)', () => {
+    const s = summarizeInClusterTests([folded(), capped()])
+    expect(s.error).toContain('capped')
+    expect(s.partial).toBe(true)
+    expect(s.evidenceOnly).toBe(false)
+  })
+
+  it('single throwaway-denied row (results+status+fallback, none folded) → evidence-only, NOT partial, NOT couldn\'t-run', () => {
+    const s = summarizeInClusterTests([throwawayDenied()])
+    expect(s.error).toBeUndefined()
+    expect(s.partial).toBe(false)
+    expect(s.evidenceOnly).toBe(true)
+    expect(s.evidence).toContain('throwaway pod')
+    expect(s.fallback).toBe('kubectl run ...')
+  })
+
+  it('all override-mismatch rows (results+status, none folded) → evidence-only note, not a silent no-op', () => {
+    const s = summarizeInClusterTests([overrideMismatch(), overrideMismatch()])
+    expect(s.evidenceOnly).toBe(true)
+    expect(s.evidence).toContain('evidence only')
+    expect(s.error).toBeUndefined()
+    expect(s.partial).toBe(false)
+  })
+
+  it('guessed-path-only row → evidence-only', () => {
+    const s = summarizeInClusterTests([guessedPath()])
+    expect(s.evidenceOnly).toBe(true)
+    expect(s.evidence).toContain('GUESSED')
+  })
+
+  it('clean full run (everything folded) → no banner at all', () => {
+    const s = summarizeInClusterTests([folded(), folded()])
+    expect(s.error).toBeUndefined()
+    expect(s.partial).toBe(false)
+    expect(s.evidenceOnly).toBe(false)
+  })
+
+  it('a couldn\'t-run row outranks evidence rows (real failure surfaces first)', () => {
+    const s = summarizeInClusterTests([overrideMismatch(), jobFailed()])
+    expect(s.error).toContain('timed out')
+    expect(s.partial).toBe(false) // nothing folded
+    expect(s.evidenceOnly).toBe(false)
+  })
+
+  it('empty / undefined input → no banner', () => {
+    expect(summarizeInClusterTests(undefined)).toEqual({ partial: false, evidenceOnly: false })
+    expect(summarizeInClusterTests([])).toEqual({ partial: false, evidenceOnly: false })
+  })
+})
+
+describe('a mixed run never says "unchanged"', () => {
+  const folded = { route: 'a', results: [{}] }
+  const evidence = { route: 'b', results: [{}], status: 'kept informational - throwaway identity' }
+
+  it('the reducer marks the mixed case partial', () => {
+    const s = summarizeInClusterTests([folded, evidence] as any)
+    expect(s.evidenceOnly).toBe(true)
+    expect(s.partial).toBe(true)
+  })
+
+  it('the banner title follows the state', () => {
+    expect(evidenceBannerTitle({ partial: true, evidenceOnly: true })).toMatch(/some routes updated/)
+    expect(evidenceBannerTitle({ partial: false, evidenceOnly: true })).toMatch(/unchanged/)
+  })
+})

package/src/components/trace/inClusterSummary.ts

@@ -0,0 +1,81 @@
+// summarizeInClusterTests reduces the per-route in-cluster outcome rows to what
+// the banner needs. The server (internal/reachability/incluster.go) returns one
+// row per route with three distinct shapes that must NOT be conflated:
+//
+//   FOLDED      results && !status  - the probe ran clean and was folded into the
+//                                     merged trace (the default branch). The route
+//                                     outcome actually moved.
+//   EVIDENCE    results && status   - the probe ran and produced results but was
+//                                     NOT folded: a throwaway-pod NetworkPolicy/mTLS
+//                                     denial, an override-mismatch (custom path), or
+//                                     a guessed wildcard path. Route outcome UNCHANGED.
+//   COULDN'T-RUN !results && (status||fallback) - the Job couldn't start / timed out /
+//                                     RBAC / pod-cap / budget. Nothing was tested.
+//
+// From these, the banner has exactly three honest states:
+//   couldn't-run   - a COULDN'T-RUN row exists and nothing folded
+//   partial        - a COULDN'T-RUN row exists but other routes DID fold
+//   evidence-only  - rows carried results but NONE folded (route outcomes unchanged)
+//   (clean full run - everything folded - shows no banner)
+
+export interface InClusterTestRow {
+  status?: string
+  fallbackCommand?: string
+  results?: unknown[]
+}
+
+export interface InClusterSummary {
+  /** A route that genuinely could NOT be tested in-cluster (Job failed / capped /
+   *  budget). Paired with `fallback`. Absent when every route at least ran. */
+  error?: string
+  fallback?: string
+  /** ≥1 route folded live results into the merged trace AND ≥1 route could not run.
+   *  The banner reads "partially completed" instead of the false "couldn't run". */
+  partial: boolean
+  /** Rows carried results but NONE folded (throwaway-denied / override-mismatch /
+   *  guessed path) - the run changed no route outcome. Surfaced as an informational
+   *  note so an all-evidence run isn't a silent no-op. */
+  evidenceOnly: boolean
+  /** The evidence row's status message (the honest per-shape explanation). */
+  evidence?: string
+}
+
+const isFolded = (t: InClusterTestRow): boolean => !!t.results?.length && !t.status
+const isEvidence = (t: InClusterTestRow): boolean => !!t.results?.length && !!t.status
+const isCouldntRun = (t: InClusterTestRow): boolean => !t.results?.length && (!!t.status || !!t.fallbackCommand)
+
+export function summarizeInClusterTests(tests: InClusterTestRow[] | undefined): InClusterSummary {
+  const entries = tests ?? []
+  const anyFolded = entries.some(isFolded)
+  const failed = entries.find(isCouldntRun)
+  if (failed) {
+    return {
+      error: failed.status || 'the in-cluster test could not run',
+      fallback: failed.fallbackCommand,
+      partial: anyFolded,
+      evidenceOnly: false,
+    }
+  }
+  // No hard failure. Any evidence row means at least one route's outcome did
+  // NOT move - surface its honest per-shape explanation. This deliberately
+  // includes the mixed case (some routes folded, some kept informational):
+  // suppressing the note there presented a partially-inconclusive run as a
+  // clean one, with the kept-informational route's status silently vanished.
+  const evidence = entries.find(isEvidence)
+  if (evidence) {
+    // partial: some routes DID fold - the banner must not say "unchanged".
+    return { partial: anyFolded, evidenceOnly: true, evidence: evidence.status, fallback: evidence.fallbackCommand }
+  }
+  // Clean full run - everything folded; the merged trace already reflects the
+  // outcomes, so there is nothing left to explain.
+  return { partial: false, evidenceOnly: false }
+}
+
+/** The evidence banner's title. Kept beside the reducer so the words cannot
+ *  drift from the state: "unchanged" was still shown for mixed runs where some
+ *  routes HAD updated. */
+export function evidenceBannerTitle(s: InClusterSummary): string {
+  return s.partial
+    ? 'In-cluster test: some routes updated — others kept informational'
+    : 'In-cluster test ran as evidence only - route outcomes unchanged'
+}

package/src/components/trace/index.ts

@@ -0,0 +1,19 @@
+export { inClusterOutcome, inClusterEligible } from './TracePanel'
+export { ReachabilityView } from './ReachabilityView'
+export { podReach, podProbeKey } from './podReach'
+// Reachability v2 internals - exported so hosts can compose the same vocabulary
+// (marks, origins) elsewhere without re-deriving it.
+export { buildOrigins, defaultOrigin, strongestGap } from './reachOrigins'
+export type { Origin, OriginId, Lane, OriginKind } from './reachOrigins'
+export { routeMark, routeTone, routeChip, orderRoutes, MARKS, MARK_LEGEND } from './reachMarks'
+export type { Mark, SevTone } from './reachMarks'
+export { traceToSubgraph } from './traceToSubgraph'
+export { traceFingerprint, staticPollUnreliable } from './traceFingerprint'
+export { summarizeInClusterTests } from './inClusterSummary'
+export type { InClusterTestRow, InClusterSummary } from './inClusterSummary'
+export { TraceSummary } from './TraceSummary'
+export type { InClusterCapability } from './TracePanel'
+// ResourceRef intentionally NOT re-exported from the package root - it would
+// collide with the global ResourceRef in types.ts. Trace consumers import it
+// from the panel module directly when they need the typed shape.
+export type { Trace, Hop, Finding, FindingSeverity, Verdict } from './types'

package/src/components/trace/podReach.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest'
+import { podReach, podProbeKey } from './podReach'
+import type { ProbeResult } from './types'
+
+describe('podProbeKey', () => {
+  it('extracts the pod identity from a "<name> port N" probe target', () => {
+    expect(podProbeKey('fleet-abc-xyz port 80')).toBe('fleet-abc-xyz') // apiserver path
+    expect(podProbeKey('10.244.0.33:8080')).toBe('10.244.0.33') // data path (ip:port)
+    expect(podProbeKey('10.244.0.33 port 8080')).toBe('10.244.0.33')
+    expect(podProbeKey('pod-1')).toBe('pod-1')
+    expect(podProbeKey(undefined)).toBe('')
+  })
+})
+
+const p = (o: Partial<ProbeResult>): ProbeResult => ({ layer: 'http', target: 'pod-1', vantage: 'local', ok: true, ...o })
+
+describe('podReach', () => {
+  it('no live probes → not tested, no vantage', () => {
+    expect(podReach([])).toEqual({ tone: 'neutral', text: 'not tested', vantage: '' })
+    expect(podReach([p({ skipped: true })])).toEqual({ tone: 'neutral', text: 'not tested', vantage: '' })
+  })
+
+  it('healthy 2xx via api proxy → healthy + "via API server"', () => {
+    const r = podReach([p({ path: 'apiserver', ok: true, tone: 'healthy', detail: 'HTTP 200' })])
+    expect(r.tone).toBe('healthy')
+    expect(r.text).toBe('HTTP 200')
+    expect(r.vantage).toBe('via API server')
+  })
+
+  it('in-cluster direct dial → labels the vantage "real"', () => {
+    const r = podReach([p({ vantage: 'in-cluster', path: 'data', ok: true, detail: 'HTTP 200' })])
+    expect(r.vantage).toBe('real')
+  })
+
+  it('a failure wins over an ok sibling (never mask a bad pod)', () => {
+    const r = podReach([
+      p({ layer: 'tcp', ok: true }),
+      p({ layer: 'http', ok: false, tone: 'unhealthy', error: 'connection refused' }),
+    ])
+    expect(r.tone).toBe('unhealthy')
+    expect(r.text).toBe('connection refused')
+  })
+
+  it('a 5xx reads degraded, not unhealthy', () => {
+    const r = podReach([p({ layer: 'http', ok: true, tone: 'degraded', detail: 'HTTP 503' })])
+    expect(r.tone).toBe('degraded')
+    expect(r.text).toBe('HTTP 503')
+  })
+
+  it('a reached 404 (ok, tone "reached") is NOT green - neutral, matching the honest headline', () => {
+    const r = podReach([p({ layer: 'http', ok: true, tone: 'reached', detail: 'HTTP 404' })])
+    expect(r.tone).toBe('neutral')
+    expect(r.text).toBe('HTTP 404')
+  })
+
+  it('a TCP-only success is "port reachable", not verified - neutral, not green', () => {
+    const r = podReach([p({ layer: 'tcp', ok: true, detail: 'connected' })])
+    expect(r.tone).toBe('neutral')
+  })
+
+  it('a TLS-only success (no HTTP 2xx) is neutral, not green', () => {
+    const r = podReach([p({ layer: 'tcp', ok: true }), p({ layer: 'tls', ok: true, detail: 'valid' })])
+    expect(r.tone).toBe('neutral')
+  })
+
+  it('a real HTTP 2xx stays green (verified path unchanged)', () => {
+    const r = podReach([p({ layer: 'tcp', ok: true }), p({ layer: 'http', ok: true, tone: 'healthy', detail: 'HTTP 200' })])
+    expect(r.tone).toBe('healthy')
+    expect(r.text).toBe('HTTP 200')
+  })
+})